Privacy & data handling

Designed for tenant-isolated, governed support data.

This page describes the current AI Fire Brigade product posture. It is not a customer-specific Data Processing Agreement and does not replace the legal, retention, residency or subprocessor schedules required for a production contract.

What the platform is designed to process

Support conversation content and operator workflow records.
Player and casino facts supplied by the customer or an authorized casino system.
Knowledge, policies, skills and AI operator configuration owned by the tenant.
Operational audit events, de-identified analytics and controlled learning outcomes.
Synthetic Casino Twin and Simulation Lab data kept separate from real-partner evidence.

Data minimization and model context

Provider credentials remain server-side and are not exposed to the browser.
Transient model context has a default retention of zero days.
Raw player messages, private prompts and provider payloads are not intentionally copied into product surfaces that require metadata only.
Cross-tenant learning is disabled by default and cannot be enabled by an ordinary tenant setting.

Residency and retention

Cloud, hybrid and private deployment modes have separate placement rules.
Sensitive facts use shorter default retention than configuration and knowledge records.
Customer-specific retention, residency and deletion requirements must be agreed before production use.
Data Control settings are versioned, tested and activated before downstream model-routing decisions rely on them.

Security and operational controls

Tenant isolation, RBAC, audit evidence and Human Review are part of the production control model.
Backups are expected to be encrypted, copied off-host and verified through scheduled restore drills.
Production secrets must be managed outside source code and rotated according to the deployment policy.
Security incidents and data-subject requests require the customer-specific escalation process agreed for the production deployment.

Before production go-live

The contracting entity, privacy contact, applicable governing law, DPA, subprocessor schedule and customer-specific retention/residency requirements must be completed in the executed agreement. AI Fire Brigade does not claim that this public product summary alone satisfies a particular jurisdiction.